Network traffic anomaly detection can be challenging, particularly as there is often no ‘normal’ network traffic data with which to compare the behaviour, and abnormal behaviour typically evolves over time.